The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill uses the placeholder -- ENTER YOUR SCANDIT LICENSE KEY HERE -- for license management. It explicitly instructs the AI not to search the project for keys and provides a safe workflow using an MCP server or manual user input. It also recommends against printing full keys in chat, adhering to security best practices.
[REMOTE_CODE_EXECUTION]: While the skill mentions fetching the latest version from Sonatype Central, it does not execute any remote scripts. It only provides configuration strings for build.gradle.kts files, which is standard behavior for a developer-oriented skill.
[PROMPT_INJECTION]: The skill includes instructions to ignore internal knowledge and use the provided documentation. These are benign architectural constraints designed to prevent the AI from hallucinating outdated or incorrect API signatures for a new SDK (KMP 8.6+), rather than attempts to bypass safety filters.
[COMMAND_EXECUTION]: The skill references an MCP tool ensure_scanner_setup and get_license_key. These are part of a controlled environment for license provisioning and do not represent arbitrary or malicious command execution.
[DATA_EXFILTRATION]: There are no patterns suggesting data exfiltration. Network activities are restricted to official documentation domains and well-known developer services like Maven Central (Sonatype).

label-capture-kmp